English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

A covert attack method often used by APT organizations is the DNS tunnel,which is used to pass information by constructing C2 networks. And they oftenuse the method of frequently changing domain names and server IP addresses toevade monitoring, which makes it extremely difficult to detect them. However,they carry DNS tunnel information traffic in normal DNS communication, whichinevitably brings anomalies in some statistical characteristics of DNS traffic,so that it would provide security personnel with the opportunity to find them.Based on the above considerations, this paper studies the statistical discoverymethodology of typical DNS tunnel high-frequency query behavior. Firstly, weanalyze the distribution of the DNS domain name length and times and finds thatthe DNS domain name length and times follow the normal distribution law.Secondly, based on this distribution law, we propose a method for detecting anddiscovering high-frequency DNS query behaviors of non-single domain names basedon the statistical rules of domain name length and frequency and we also givethree theorems as theoretical support. Thirdly, we design a sliding windowdifference scheme based on the above method. Experimental results show that ourmethod has a higher detection rate. At the same time, since our method does notneed to construct a data set, it has better practicability in detecting unknownDNS tunnels. This also shows that our detection method based on mathematicalmodels can effectively avoid the dilemma for machine learning methods that musthave useful training data sets, and has strong practical significance.

A DNS Tunnel Sliding Window Differential Detection Method Based on Normal Distribution Reasonable Range Filtering